DESIGN AND IMPLEMENTATION OF A SECURE INTRA-PLATFORM REAL-TIME MESSAGING SYSTEM FOR SOCIAL MEDIA APPLICATIONS

Abstract

Real-time messaging has become a central interaction layer in social media, yet persistent connections, multi-device sessions, third-party integrations and large user populations create security risks that conventional request-response controls do not fully address. This study designs, implements and evaluates a secure intra-platform messaging framework that combines persistent WebSocket communication with end-to-end encrypted message payloads, short-lived identity tokens, conversation-level authorization, replay resistance, rate limiting, privacy-preserving audit events and reliable delivery semantics. The work follows a design-science methodology comprising problem analysis, threat modelling, architectural design, prototype construction and controlled evaluation. A single-node prototype was implemented with an asynchronous WebSocket gateway, HTTPS fallback endpoint, JSON Web Token validation, origin checking, AES-256-GCM payload protection, message-size enforcement and connection-level flood control. Functional security tests examined unauthorized origins, expired and invalid tokens, missing authentication, excessive message rates and oversized payloads. Performance was measured at 25, 50, 100 and 200 concurrent users, with each client transmitting fifteen encrypted messages. The WebSocket design maintained mean round-trip latency between 0.83 and 8.12 milliseconds, compared with 5.91 to 54.42 milliseconds for HTTPS request-response messaging. At 200 users, WebSocket throughput reached 4,315.55 messages per second, while all seven security tests produced the expected rejection or acceptance behaviour. The findings indicate that a layered architecture can deliver low latency without treating transport encryption as a substitute for end-to-end confidentiality. The article contributes a reproducible architecture, logical data model, secure message lifecycle, implementation controls and evaluation framework for privacy-conscious social media messaging under realistic concurrent laboratory loads.